Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/esphome@1.13.2
purl pkg:pypi/esphome@1.13.2
Next non-vulnerable version 2021.9.2
Latest non-vulnerable version 2025.12.7
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-mff6-1k8j-jbhp
Aliases:
CVE-2021-41104
GHSA-48mj-p7x2-5jfm
PYSEC-2021-351
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.
2021.9.2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:14:44.583703+00:00 Pypa Importer Affected by VCID-mff6-1k8j-jbhp https://github.com/pypa/advisory-database/blob/main/vulns/esphome/PYSEC-2021-351.yaml 38.6.0